CVE-2025-32431

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/../other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

Workaround

Add a PathRegexp rule to the matcher to prevent matching a route with a /../ in the path.

Example:

match: PathPrefix(`/service`) && !PathRegexp(`(?:(/\.\./)+.*)`)

For more information

If you have any questions or comments about this advisory, please open an issue.

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

• https://github.com/traefik/traefik/releases/tag/v2.11.24
• https://github.com/traefik/traefik/releases/tag/v3.3.6
• https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

1. What is CVE-2025-32431? CVE-2025-32431 is a high-severity path traversal vulnerability in github.com/traefik/traefik (go), affecting versions <= 1.7.34. It is fixed in 2.11.23, 3.3.6, 3.4.0-rc2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which packages are affected by CVE-2025-32431?
   • github.com/traefik/traefik (go) (versions <= 1.7.34)
   • github.com/traefik/traefik/v2 (go) (versions < 2.11.23)
   • github.com/traefik/traefik/v3 (go) (versions < 3.3.6)
3. Is there a fix for CVE-2025-32431? Yes. CVE-2025-32431 is fixed in 2.11.23, 3.3.6, 3.4.0-rc2. Upgrade to this version or later.
4. Is CVE-2025-32431 exploitable, and should I be worried? Whether CVE-2025-32431 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-32431 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-32431?
   • Upgrade github.com/traefik/traefik/v2 to 2.11.23 or later
   • Upgrade github.com/traefik/traefik/v3 to 3.3.6 or later
   • Upgrade github.com/traefik/traefik/v3 to 3.4.0-rc2 or later